HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

JA4 TLS client fingerprint

t13i1010h1_61a7ad8aa9b6_792d2c6655cb

Seen 2026-04-23 to 2026-09-19 across the retained window.

Open in lookup →

1.1K

Source IPs

4

Networks

23

Countries

207

Ports hit

52.7K

Events

282

IPs / network

Top networks

AS396982 Google LLC1.1K IPs52.7K
AS198953 Proton66 OOO1 IPs20
AS31898 Oracle Corporation1 IPs6
AS16276 OVH SAS1 IPs4

Countries

US 552BE 88JP 64NL 45GB 40ES 40CA 39TW 34DE 32FI 31

Ports targeted

5001/tcp 1.7K8190/tcp 1.7K443/tcp 1.6K8160/tcp 1.6K82/tcp 1.5K9202/tcp 1.4K37777/tcp 1.2K5984/tcp 1.2K5601/tcp 1.2K7443/tcp 1.2K8082/tcp 1.1K84/tcp 1.1K

What it requests

GET/config.json256
GET/config.js253
GET/gcp.json250
GET/keys.json248
GET/credentials.json246
GET/appsettings.json241
GET/phpinfo.php231
GET/.htaccess230
GET/auth.json228
GET/info.php222
GET/secrets.yml217
GET/secrets.yaml215

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36899 IPs51.3K
crusader-worker/1.0235 IPs1.3K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.2031 IPs20
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.361 IPs6
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.361 IPs4
Source IPCCNetwork Last seenEvents
35.204.6.226NLAS396982 Google LLC2026-09-07814
34.156.32.40BEAS396982 Google LLC2026-09-07497
35.234.154.24GBAS396982 Google LLC2026-09-05489
34.65.142.17CHAS396982 Google LLC2026-09-04470
35.246.156.146DEAS396982 Google LLC2026-08-30441
34.156.46.158BEAS396982 Google LLC2026-08-31438
35.245.139.118USAS396982 Google LLC2026-08-30435
35.253.107.57USAS396982 Google LLC2026-09-05433
35.224.229.54USAS396982 Google LLC2026-08-31422
35.203.90.10CAAS396982 Google LLC2026-09-05409
34.19.244.8CAAS396982 Google LLC2026-09-05404
34.156.255.128BEAS396982 Google LLC2026-08-28404
35.255.237.118USAS396982 Google LLC2026-09-04391
35.229.30.181USAS396982 Google LLC2026-09-05381
34.48.67.18USAS396982 Google LLC2026-09-04372
34.66.162.121USAS396982 Google LLC2026-09-04368
34.179.252.109DEAS396982 Google LLC2026-09-04365
136.107.142.125USAS396982 Google LLC2026-08-28363
136.64.152.102USAS396982 Google LLC2026-08-28361
34.10.60.111USAS396982 Google LLC2026-09-03357

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.